Moritz Jodeit - Black Hat Briefings...•Strong focus on application security •Did some research...

Moritz Jodeit moritz.jodeit@nruns.com

Twitter: @moritzj

Agenda

• Attack Surface

• Firmware Analysis

• Device Rooting

• System Architecture

• Vulndev Environment

• Remote H.323 Exploit

• Post Exploitation

Who am I?

• From Hamburg, Germany

• Senior Security Consultant at n.runs AG

• Strong focus on application security

• Did some research on USB security in the past

• Enjoys bug hunting

Background

Background

• Communication between two or more parties

• Transmission over packet-based networks

– IP or ISDN

• Dedicated vs. Desktop systems

Revenue Market Share

Top Five Enterprise Videoconferencing and Telepresence Vendors

Cisco (50.6%)

Polycom (26.3%)

Others (13.1%)

Lifesize (5%)

Teliris (2.6%)

Vidyo (2.5%)

Published by IDC for Q1 2012

Polycom

• One of the leading vendors

• Different telepresence solutions

• Most popular units cost up to $25,000

• Polycom customers

– Government agencies / ministries worldwide

– World’s 10 largest banks

– 6 largest insurance companies

Polycom HDX Systems

• Popular video conferencing solution

• Different configurations (HDX 4000 – 9000)

• HDX 7000 HD (our lab equipment)

– EagleEye HD camera

– Mica Microphone array

– Remote control

– Connected to ext. display

Attack Surface

Attack Surface

Attack Surface

• Polycom HDX Web Interface

• Provisioning Service

• API Interface (serial console or TCP port 24)

• Polycom Command Shell (TCP port 23)

• SNMP

• Video conferencing protocols

– H.323 and SIP

Attack Surface

• Polycom HDX Web Interface

• Provisioning Service

• API Interface (serial console or TCP port 24)

• Polycom Command Shell (TCP port 23)

• SNMP

• Video conferencing protocols

– H.323 and SIP

Attack Surface

• Polycom HDX Web Interface

• Provisioning Service

• API Interface (serial console or TCP port 24)

• Polycom Command Shell (TCP port 23)

• SNMP

• Video conferencing protocols

– H.323 and SIP

Attack Surface

• Polycom HDX Web Interface

• Provisioning Service

• API Interface (serial console or TCP port 24)

• Polycom Command Shell (TCP port 23)

• SNMP

• Video conferencing protocols

– H.323 and SIP

Attack Surface

• Polycom HDX Web Interface

• Provisioning Service

• API Interface (serial console or TCP port 24)

• Polycom Command Shell (TCP port 23)

• SNMP

• Video conferencing protocols

– H.323 and SIP

Firmware Analysis

Firmware Analysis

• Software updates at support.polycom.com

• ZIP archives contain single PUP files

• Manual installation or via provisioning server

• Analysis based on version 3.0.5

PUP File Structure

PUP File Structure

• PUP file header

• Bootstrap archive

– Bootstrap code to install update

– Main functionality in setup.sh script

• Update package

PUP Header

• Figuring out the PUP header file format

• Found puputils.ppc in extracted firmware

– Polycom Update Utilities

– Used to verify and install updates

– Can be run inside Qemu (Debian on PPC)

PUP Header

• Every PUP file starts with fixed PUP file ID

– “PPUP” or “PPDP”

• Several fixed-size fields

– Padded with null bytes

Length (bytes) Description

5 PUP File ID

4 Header Version

20 Header MAC Signature

32 Processor Type

32 Project Code Name

16 Software Version

16 Type of Software

32 Hardware Model

16 Build Number

32 Build Date

16 Build By

16 File Size (without header)

5 Compression algorithm

445 Supported Hardware

81 Signature (ASN.1 encoded)

Length (bytes) Description

5 PUP File ID

4 Header Version

20 Header MAC Signature

32 Processor Type

32 Project Code Name

16 Software Version

16 Type of Software

32 Hardware Model

16 Build Number

32 Build Date

16 Build By

16 File Size (without header)

5 Compression algorithm

445 Supported Hardware

81 Signature (ASN.1 encoded)

Header HMAC

• Header HMAC value stored in PUP header

• Verification process

1. Set Header HMAC field to zero

2. Calculate HMAC over PUP header

3. Compare result with stored value

4. Abort update if result doesn’t match

Header HMAC

Header HMAC

• Secret is required for verification

– Must be stored on the device

– Can be extracted :)

• Hardcoded in puputils.ppc binary

Header HMAC

• Secret is required for verification

– Must be stored on the device

– Can be extracted :)

• Hardcoded in puputils.ppc binary

Header HMAC

• With the secret we can calculate a valid HMAC

• We didn’t reverse the used HMAC algorithm

– We don’t even need a debugger

– The correct HMAC is part of the error message!

Public Key DSA Signature

• Second protection to prevent file tampering

• Used in addition to the header HMAC

• Verifies integrity of the whole file

– Including the PUP header

• Signature is stored in PUP header

– ASN.1 encoded form

• No further analysis conducted

Device Rooting

Device Rooting

• No system level access to the device

• Reasons for getting root access

– Simplifies bug hunting

– More device control for fuzzing

• Process monitoring

• Restarting processes

– Makes exploit development a lot easier

HDX Boot Modes

• HDX offers two boot modes

– Production vs. Development

Development Mode

• Used by Polycom internally

• Can still be enabled in released firmware

• Enables NFS-mounted developer workspace

• Enables telnet server on port 23

• Allows root login without password

Enabling Development Mode

• Development mode enabled in startup script

– U-Boot environment variable devboot

• Flash variable othbootargs

– Stores additional kernel parameters

– Can be used to set devboot variable

• Modifying flash variables...

Polycom Command Shell

• Provided on TCP port 23 or serial console

Polycom Command Shell

• Commands to read/write flash variables

– printenv and setenv

Device Rooting

Development Mode

• Not all services enabled in this mode

– End-user services not running

– Web interface not started

• Just add permanent root access

– E.g. in /etc/inetd.conf.production

• Switch back to production mode

– /opt/polycom/bin/devconvert normal

Device Rooting – Method #2

• Use command injection to root the device

• Not too hard to find (at least in v3.0.5)

• Example: Firmware Update Functionality

– PUP filename embedded in shell command

– Just use the following PUP filename

test;logger PWNED;#.pup

Device Rooting – Method #2

Problems with previous Methods

• Described rooting methods not long-lasting

– Bugs get fixed

• We could just try to find new bugs

– Unpredictable time investment

– Increases effort

Device Rooting – Method #3

• We know the old bugs

• Strategy

– Downgrade to old (vulnerable) firmware

– Exploit known vulnerability & persist

– Re-upgrade to current version

• Removal of downgrade feature less likely

System Architecture

System Architecture

• PowerPC based Linux system

• Kernel 2.6.33.3

• U-Boot boot loader

• Comes with standard binaries

– busybox

– wget

– gdbserver

– …

Filesystem

• Polycom-specific files reside in /opt/polycom

– Binaries

– Configuration files

Partition Description Mounted

/dev/hda1 Boot related files, Linux kernel image ro

/dev/hda2 Root file system ro

/dev/hda3 Log and configuration files rw

/dev/hda4 Factory restore file system --

Configuration Files

• Stored as .dat files in /opt/polycom/dat

• One configuration setting per file

• Text-based files

– One or more lines of text

Main Processes

• AppMain Java Process

– GUI

– Web interface functionality

– User authentication + crypto functionality

• Polycom AVC

– H.323

– SIP

AppMain Java Process

• Code scattered around several JAR files

– /opt/polycom/bin/*.jar

• Running as root

AppMain Java Process

• Good place to look for web interface bugs

– Lighttpd communicates with FastCGI

– Every CGI handler extends class polycom.web.CGIHandler

– Can easily be identified during code audits

• Also implements user authentication

– For all device interfaces

– Place to look for auth bypasses / backdoors

Polycom AVC

• Implemented in /opt/polycom/bin/avc

• Huge non-stripped binary (~ 50 MB)

• Implemented in C

• Running as root

• E.g. implementation of H.323 and SIP

– and many other complicated protocols…

• What could possibly go wrong? :)

Polycom AVC

• The place to look for bugs in videoconferencing protocols

• > 800 xrefs to strcpy()

• > 1400 xrefs to sprintf()

• No exploit mitigations at all

• Easy to reverse engineer due to symbols

Vulndev Environment

Remote Debugging

• Working debug environment helps

– Eases bug hunting

– Simplifies exploit development process

• Debugging on the device

– No option due to memory constraints

• HDX systems come with gdbserver

– Use powerpc-linux-gdb for remote debugging

– Don’t forget to specify remote shared libs

Remote Debugging

• Remotely attaching to debug stub…

Watchdog Daemon

• Polycom Watchdog daemon

– Detects crashes and non-responding processes

– Reboots the system

• Must be disabled for debugging

– Just killing watchdogd reboots the system :(

– Daemon checks for config files on startup

• /opt/polycom/dat/watchdog_disable.dat

– Creating that (empty) file disables the daemon

Ready for Bug Hunting…

• But what are we looking for?

– Finding web interface bugs seems easy

• But should be blocked in secured environment

– Same is true for the other admin interfaces

• Signaling protocols must be accepted

– Either H.323 or SIP

• We focus on H.323 for this case study

Developing Remote Exploit

H.323 Protocol

• Umbrella recommendation from ITU-T

• Consists of several different standards

– Complexity!

• Some are more important than others

– From a bug hunting perspective

H.323 Signaling Protocols

• H.225.0-Q.931

– Call signaling and media packetization

– Used for setting up / releasing calls

• H.225.0-RAS

– Signaling between endpoints and gatekeepers

• H.245

– Signaling between two endpoints

– Capability exchange / media stream control

H.225.0-Q.931

• Consists of binary encoded messages

• Messages consist of Information Elements (IE)

– Encoded in ASN.1

• Several different IE’s are defined

• IE’s provide information to the remote site

– Callers identity

– Capabilities

– etc.

H.225.0-Q.931

Call Initiation

• Client connects to TCP port 1720

• Sends SETUP packet

– Indicates clients desire to start a call

• SETUP packet is parsed even if the call fails

– E.g. call is not accepted by remote site

• Full call establishment requires more msgs

– But not relevant for this discussion

Call Detail Records

• HDX systems store call detail records (CDRs)

– Also written for failed calls

– Every SETUP packet generates CDR entry

• CDR table stored in SQLite database

– Written records include

• Call start/end time

• Call direction

• Remote system name extracted from Display IE!

• …

Vulnerabilities

• Missing input validation on Display IE

– Leads to two different vulnerabilities

• SQL injection with single SETUP packet :)

SQL Injection Exploit Challenges

• Constructed SQL query string passed to sqlite3_prepare_v2 API function

• SQLite documentation says:

SQL Injection Exploit Challenges

• We can’t just append a new statement

• Couldn’t find a way to exploit it

– Might still be exploitable

– Let me know if you find a way ;)

• But what about the second vulnerability?

Vulnerability #2

• Constructed SQL query string written to log

– Ends up calling vsnprintf() function

– Query string is passed as format string

Vulnerability #2

• Straightforward format string bug :)

– Set Display Information Element to:

WE CONTROL THIS %n%n%n

• Triggered with a single SETUP packet

Exploiting the Format String Bug

• 101 format string exploitation techniques

• Few complications when it comes to details

– Refer to the whitepaper for details

• Exploit works like this

– Turn bug into write4 primitive (single SETUP pkt)

– Use write4 primitive to store shellcode

– Trigger again to overwrite function pointer

– PROFIT!

Final PoC Exploit

• PoC uses simple system() shellcode

– Executes our HDX payload

– Provides back-connect shell

• Successful exploitation yields root shell

Post Exploitation

Post Exploitation

• We want to control the device’s peripherals

– PTZ camera, microphone, display, etc.

• Reversing the Polycom Command Shell

– Offers CLI for most interesting actions

– Most functionality implemented by Java component

– Communication via XCOM IPC

Polycom XCOM IPC

• Polycom’s internal IPC mechanism

• Simple text-based protocol

• Provided locally on port 4121

• Async data receival (UNIX domain sockets)

• Every PSH command can be used

Polycom XCOM IPC

• Character prefix indicates command or response class

• Commands answered with single line response (“R:”)

• Notifications (“N:”) received asynchronously

Demo

Polycom Disclosure Process

• Extremely good vendor communication

– Responsive, professional, transparent

– Even offered a test build prior publication

• Others could learn a lesson from Polycom

• All issues fixed in version 3.1.1.2

– Just got released this week (2013/03/14)!

Thank you!

Moritz Jodeit moritz.jodeit@nruns.com

Please complete the Speaker Feedback Surveys

Moritz Jodeit moritz.jodeit@nruns.com